The files in this distribution have been digitally signed using PGP. Each
signed file has a corresponding filename.asc signature file in the
same directory. The signing keys can be found in the distribution directory
at <
http://www.apache.org/dist/commons/KEYS>.

Always download the KEYS file directly from the Apache site, never from a
mirror site.

Always test available signatures, to ensure that what you download has not
been tampered with. How you do this depends on the tools that you use. Here
are a few examples: